Bind MCP indexing to authorized filesystem identities #4584

Workflow file for this run

	name: Build and Test

	on:
	push:
	branches:
	- main
	paths-ignore:
	- '**.md'
	- 'LICENSE'
	- 'LICENSES/**'
	pull_request:
	branches:
	- main
	paths-ignore:
	- '**.md'
	- 'LICENSE'
	- 'LICENSES/**'
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.run_id }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	permissions:
	contents: read

	jobs:
	build:
	strategy:
	matrix:
	include:
	- os: ubuntu-24.04
	test-framework: net8.0
	sdk-versions: \|
	8.0.413
	9.0.301
	primary_lane: true
	- os: ubuntu-24.04
	test-framework: net9.0
	sdk-versions: 9.0.301
	primary_lane: false
	- os: windows-2022
	test-framework: net8.0
	sdk-versions: \|
	8.0.413
	9.0.301
	primary_lane: false
	- os: macos-14
	test-framework: net8.0
	sdk-versions: \|
	8.0.413
	9.0.301
	primary_lane: false
	runs-on: ${{ matrix.os }}
	timeout-minutes: 90
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Configure Windows test host
	if: runner.os == 'Windows'
	shell: pwsh
	run: ./.github/scripts/configure-windows-test-host.ps1 -Workspace "${{ github.workspace }}"

	- name: Set up .NET SDK
	id: setup-dotnet
	continue-on-error: true
	uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
	with:
	dotnet-version: ${{ matrix.sdk-versions }}

	- name: Retry .NET SDK setup
	if: steps.setup-dotnet.outcome == 'failure'
	uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
	with:
	dotnet-version: ${{ matrix.sdk-versions }}

	- name: Cache NuGet packages
	uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
	with:
	path: \|
	~/.nuget/packages
	~\AppData\Local\NuGet\packages
	# Locked restore keeps package inputs honest; avoid evicting the cache for project-only test edits.
	# locked restore がパッケージ入力を検証するため、テスト用 project だけの変更ではキャッシュを失効させない。
	key: ${{ runner.os }}-dotnet-nuget-${{ hashFiles('**/packages.lock.json', 'global.json') }}

	# --locked-mode requires every resolved package to match the committed
	# packages.lock.json so an unexpected transitive bump (including silent
	# native swaps under SQLitePCLRaw.bundle_e_sqlite3) fails the build
	# instead of slipping into CI/release artifacts. See issue #1556.
	# --locked-mode は packages.lock.json と完全一致する解決を強制するため、
	# SQLitePCLRaw.bundle_e_sqlite3 の native を含む推移依存の予期せぬ
	# bump が CI / release アーティファクトに紛れ込まずビルド失敗で気付ける。
	# 詳細は issue #1556 参照。
	- name: Restore dependencies
	if: matrix.primary_lane
	run: dotnet restore CodeIndex.sln --locked-mode

	- name: Restore test dependencies
	if: ${{ !matrix.primary_lane }}
	run: dotnet restore tests/CodeIndex.Tests/CodeIndex.Tests.csproj -p:RestoreTargetFrameworks=${{ matrix.test-framework }} --locked-mode

	- name: Audit NuGet package vulnerabilities
	if: matrix.primary_lane
	shell: pwsh
	run: \|
	$auditOutput = dotnet list src/CodeIndex/CodeIndex.csproj package --vulnerable --include-transitive 2>&1
	$auditExitCode = $LASTEXITCODE

	$auditOutput \| ForEach-Object { Write-Host $_ }

	if ($auditExitCode -ne 0) {
	exit $auditExitCode
	}

	if ($auditOutput -match '\b(High\|Critical)\b') {
	throw "High or critical NuGet vulnerability detected."
	}

	- name: Verify Release test build
	if: matrix.primary_lane
	run: dotnet build tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework ${{ matrix.test-framework }} --no-restore -p:UseSharedCompilation=false

	- name: Verify developer task wrapper
	if: matrix.primary_lane
	run: make lint

	- name: Build
	if: ${{ !matrix.primary_lane }}
	run: dotnet build tests/CodeIndex.Tests/CodeIndex.Tests.csproj --configuration Release --framework ${{ matrix.test-framework }} --no-restore

	- name: Test
	id: test
	shell: pwsh
	run: \|
	./.github/scripts/run-dotnet-tests.ps1 `
	-Framework "${{ matrix.test-framework }}" `
	-CollectCoverage "${{ matrix.primary_lane }}"

	- name: Summarize TRX telemetry
	if: always() && steps.test.outputs.summarize == 'true'
	run: dotnet run --project tools/CodeIndex.TestTelemetry --configuration Release --no-build --no-restore -- summarize --results-directory ./TestResults --top 10

	- name: Upload test results
	if: always() && (steps.test.outputs.summarize == 'true' \|\| failure())
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: TestResults-${{ matrix.os }}-${{ matrix.test-framework }}
	if-no-files-found: warn
	overwrite: true
	retention-days: 14
	path: \|
	TestResults/*/.trx
	TestResults/*/.txt
	TestResults/*/.xml

	- name: Upload diagnostic dumps
	if: failure()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	continue-on-error: true
	with:
	name: DiagnosticDumps-${{ matrix.os }}-${{ matrix.test-framework }}
	if-no-files-found: ignore
	overwrite: true
	retention-days: 7
	path: \|
	TestResults/*/.dmp
	TestResults/*/.dump
	TestResults/*/.hangdump

	- name: Upload coverage reports
	if: always() && matrix.primary_lane
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: Coverage-${{ matrix.os }}-${{ matrix.test-framework }}
	if-no-files-found: warn
	overwrite: true
	retention-days: 14
	path: TestResults/**/coverage.cobertura.xml

	- name: Publish
	if: matrix.primary_lane
	run: dotnet publish src/CodeIndex/CodeIndex.csproj --configuration Release --no-build --no-restore --output publish

	- name: Upload build artifact
	if: matrix.primary_lane
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: CodeIndex
	overwrite: true
	retention-days: 14
	path: publish/**

Navigation Menu

Bind MCP indexing to authorized filesystem identities #4584

Workflow file

Bind MCP indexing to authorized filesystem identities #4584

Uh oh!

Workflow file for this run